Skip to content
OpenAdvisories

Vendor

add-ons.org

27 known vulnerabilities.

Products

PDF for WPForms 5 PDF for Elementor Forms + Drag And Drop Template Builder 4 Drag and Drop File Upload for Elementor Forms 3 PDF Invoice Builder for WooCommerce 3 PDF for Contact Form 7 2 Drag and Drop File Upload for Contact Form 7 1 Product File Upload for WooCommerce 1 PDF for Contact Form 7 + Drag and Drop Template Builder 1 Repeater Fields for Gravity Forms 1 PDF for Gravity Forms + Drag And Drop Template Builder 1 Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail 1 Cost Calculator for Elementor 1 Repeater Fields for Elementor Forms 1 PDF for WPForms + Drag and Drop Template Builder 1 PDF Invoice for WooCommerce + Drag and Drop Template Builder 1
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • High 7.5
    CVE-2026-94664

    WordPress PDF for Contact Form 7 plugin <= 7.1.0 - Arbitrary File Download vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Path Traversal.This issue affects PDF for Contact Form 7: from n/a through 7.1.0.

    add-ons.org PDF for Contact Form 7
  • High 7.2
    CVE-2026-94573

    Repeater Fields for Elementor Forms <= 2.2.7 - Unauthenticated Stored Cross-Site Scripting via Repeater Field Value

    The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Field Value in all versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping. This makes it possible f…

    add-ons.org Repeater Fields for Elementor Forms Web / CMS
  • High 7.2
    CVE-2026-84293

    Repeater Fields for Gravity Forms <= 3.0.4 - Unauthenticated Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values

    The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This make…

    add-ons.org Repeater Fields for Gravity Forms Web / CMS
  • High 8.1
    CVE-2026-5364

    Drag and Drop File Upload for Contact Form 7 <= 1.1.3 - Unauthenticated Arbitrary File Upload via sanitize_file_name Bypass

    The Drag and Drop File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file upload in versions up to, and including, 1.1.3. This is due to the plugin extracting the file extension before sanitization occurs and allowing the file type…

    add-ons.org Drag and Drop File Upload for Contact Form 7 Web / CMS
  • High 8.8
    CVE-2025-60084

    WordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin <= 6.5.0 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder pdf-for-elementor-forms allows Object Injection.This issue affects PDF for Elementor Forms + Drag And Drop Template Builder: from n/a throu…

    add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder
  • High 7.5
    CVE-2025-60080

    WordPress PDF for Gravity Forms + Drag And Drop Template Builder plugin <= 6.5.0 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Gravity Forms + Drag And Drop Template Builder pdf-for-gravity-forms allows Object Injection.This issue affects PDF for Gravity Forms + Drag And Drop Template Builder: from n/a through <= …

    add-ons.org PDF for Gravity Forms + Drag And Drop Template Builder
  • High 8.8
    CVE-2025-60083

    WordPress PDF Invoice Builder for WooCommerce plugin <= 6.5.0 - Deserialization of untrusted data vulnerability

    Deserialization of Untrusted Data vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows Object Injection.This issue affects PDF Invoice Builder for WooCommerce: from n/a through <= 6.5.0.

    add-ons.org PDF Invoice Builder for WooCommerce Web / CMS
  • High 8.8
    CVE-2025-60081

    WordPress PDF for Contact Form 7 plugin <= 6.5.0 - Deserialization of untrusted data vulnerability

    Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Object Injection.This issue affects PDF for Contact Form 7: from n/a through <= 6.5.0.

    add-ons.org PDF for Contact Form 7
  • High 8.8
    CVE-2025-60082

    WordPress PDF for WPForms plugin <= 6.5.0 - Deserialization of untrusted data vulnerability

    Deserialization of Untrusted Data vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Object Injection.This issue affects PDF for WPForms: from n/a through <= 6.5.0.

    add-ons.org PDF for WPForms
  • High 8.6
    CVE-2025-47492

    WordPress Drag and Drop File Upload for Elementor Forms plugin <= 1.4.3 - Arbitrary File Deletion Vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org Drag and Drop File Upload for Elementor Forms drag-and-drop-file-upload-for-elementor-forms allows Path Traversal.This issue affects Drag and Drop File…

    add-ons.org Drag and Drop File Upload for Elementor Forms
  • High 7.6
    CVE-2025-47537

    WordPress PDF Invoice Builder for WooCommerce plugin <= 5.3.8 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows SQL Injection.This issue affects PDF Invoice Builder for WooCommerce: from n/a thr…

    add-ons.org PDF Invoice Builder for WooCommerce Web / CMS